CVE Intelligence
Home / Threat actors / AppleJeus

AppleJeus G1049

🔔 Create alert

Also known as: Gleaming Pisces, Citrine Sleet, UNC1720, UNC4736

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

1
associated CVEs
2
Techniques
0
Malware and tools

AppleJeus is a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau. Associated with the broader Lazarus Group umbrella of actors, AppleJeus has been active since at least 2018 and is closely aligned in resources with TEMP.hermit, another DPRK-affiliated group under the same umbrella. The group’s primary mission is to generate and launder revenue to provide financial support to the government. AppleJeus primarily targets the cryptocurrency industry and is most notably responsible for the 3CX Supply Chain Attack. The group traditionally deploys malicious cryptocurrency software in combination with Phishing. From these compromised environments, it selectively deploys additional backdoors to enable extended operations against high-value financial targets.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2022-0609 High · 8.8 KEV Google Chromium Animation Use-After-Free Vulnerability
“3CX Supply Chain Attack: During the 3CX Supply Chain Attack, AppleJeus leveraged the Chrome vulnerability, CVE-2022-0609, in combination with a Drive-by Compromise website.”

Techniques by tactic

Initial Access
T1566 Phishing
Impact
T1657 Financial Theft

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.